Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94155
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.179 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CANUQDCg0XXsetUAwT18kX5p1eeMk_e2XCEmZj9dGoFr9keRtPA@mail.gmail.com>
References: <CAEDdnaX_KbaZB=3WzFAp73E0dCxx5zuoqMbPbakMUGpHyRPJFg@mail.gmail.com>
 <CADqTB_ijxN_ZVcAdLrpnejtYNO2x6Z1Q4PcnARCRE+etDuhF3w@mail.gmail.com>
 <CANUQDCjgSohsYWmkWOLfdL+9Jzio_uY-vnYVc4fzd6kmGaL46g@mail.gmail.com>
 <CADyq6sJmj=bnN+65-59UrsJuuc8dYxP3HPqNOktjnRFexcFVWA@mail.gmail.com>
 <CAEDdnaUz3_6sVN07G+KF15B0avDoTV85UiR1mLie-F3orMrUog@mail.gmail.com>
 <57665E36.60302@lsces.co.uk> <CADyq6sKPDtC5Q=OV7D5qQF2W6XgJCyKXpatU0KB=StveXA8pdw@mail.gmail.com>
 <5766D311.6030503@lsces.co.uk> <CAKws9z3UyQxiXpC8Jbv5tf6guzn+pgdp76B49ZsUdS08s-Jtaw@mail.gmail.com>
 <CAMPTd_A86iCrytrHwp87GyjLU8FX+BbLsdREOpNfUc=_McRMow@mail.gmail.com>
 <CAEDdnaUi5hvOAkkPWWk3YVNxMjsCbntB-W70a8sPXFkKHJGY8w@mail.gmail.com>
 <CAMPTd_DADkueRwN9AR0VNtGWg+Q58ab7JR=7meaj7fTohGZsww@mail.gmail.com>
 <CAEDdnaXG1MFXhXDpYt97Jn0aNKZ0+Rjw8O4OFSMOXmNxiaigGg@mail.gmail.com>
 <d2cae49a-1b7d-0d18-29eb-08b58889f2a2@gmail.com> <CADqTB_j_BdXHPzd-fkmtSTL8ZCSR3XCgfGO+8nd_2YTkJzd+tQ@mail.gmail.com>
 <57680CF5.2070003@lsces.co.uk> <CADqTB_gvmqpKvqRsAOGuCWFymowaxLSwzCeNt+UpBdtbep_k6Q@mail.gmail.com>
 <CANUQDCg0XXsetUAwT18kX5p1eeMk_e2XCEmZj9dGoFr9keRtPA@mail.gmail.com>
Date: Mon, 20 Jun 2016 21:40:05 +0500
Message-ID: <CAEDdnaUQC5eL2a2gFKjiE9GiJbrpf19Ky7JBop3FEPtncRUwAQ@mail.gmail.com>
To: Niklas Keller <me@kelunik.com>
Cc: Rasmus Schultz <rasmus@mindplay.dk>, Lester Caine <lester@lsces.co.uk>, 
	PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113ff1705b329b0535b85bb6
Subject: Re: [PHP-DEV] New escaped output operator
From: michael.vostrikov@gmail.com (=?UTF-8?B?0JzQuNGF0LDQuNC7INCS0L7RgdGC0YDQuNC60L7Qsg==?=)

--001a113ff1705b329b0535b85bb6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Davey

> - https://marc.info/?t=3D145851323800001&r=3D1&w=3D2 =E2=80=94 automatic =
template
escaping
> - https://marc.info/?t=3D135082660600002&r=3D1&w=3D2 =E2=80=94 this one e=
ven proposed
the same syntax!
> - https://marc.info/?t=3D144225546000001&r=3D1&w=3D2 =E2=80=94 tainted va=
riables also
"solves" this problem

These discussions and arguments against are all about
super-universal-escaping operator, and that escaping method depends on
context. Third discussion is even a little different thing, second
discussion is more closer to my proposal.
I suggest an operator for special context - HTML markup, because this is
most often used context. This is shown in examlple below.


Rowan

> I think you are rather overstating how much of a "special edge case" it
is to echo a variable into other contexts like URLs,
> or JS. It doesn't need to be anything fancy, just an innocent-looking
snippet like this:
> <ul>
> <?php foreach ( $things as $thing ) { ?>
> <li><a href=3D"/things/<?=3D $thing['name'] ?>" onclick=3D"show_popup('<?=
=3D
$thing['name'] ?>');"><?=3D $thing['name'] ?></a>
> <?php } ?>
> </ul>
> There are three different escape mechanism needed there; if there is a
shorthand for one,
> do you think it will be more likely or less that people will get the
other two right?

Actually, htmlspecialchars() is needed in all three cases:

<?php $thing =3D ['name' =3D> 'Say "Hello")']; ?>

<a
    href=3D"/things/<?=3D htmlspecialchars(urlencode($thing['name'])) ?>"
    onclick=3D"alert(<?=3D htmlspecialchars(json_encode($thing['name']),
ENT_QUOTES) ?>); return false"
>
    <?=3D htmlspecialchars($thing['name']) ?>
</a>

You may not write htmlspecialchars together with urlencode just because
urlencode encodes all special characters with its own way.
Imagine that urlencode does not encode quotes - what function should we
call for its result?

That's why I say this is very often case. The main purpose of PHP - is
web-programming and generating HTML (hypertext preprocessor, yes).
The fact itself, that there were many discussions about it, indicates that
it is a necessary feature.

--001a113ff1705b329b0535b85bb6--